seaworthycode 1.1.2 → 1.2.3

package/rules/external/security/path-traversal.yaml

@@ -0,0 +1,210 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-22
+id: security.path-traversal
+severity: high
+category: security
+min-tier: free
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.path-traversal.name
+  description-key: checks.path-traversal.description
+  message-key: checks.path-traversal.message
+  degraded-key: checks.path-traversal.degraded
+  remediation-key: remediation.security.path-traversal
+
+confidence: medium
+
+filters:
+  exclude-captures:
+    path:
+      - CONFIG_PATH
+      - BASE_DIR
+      - UPLOAD_DIR
+
+queries:
+  javascript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (binary_expression
+          left: (string) @left
+          operator: "+"
+          right: (identifier) @right))
+      (#eq? @obj "fs")
+      (#match? @method "^(readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|open|readdir|unlink|mkdir|access|stat|createReadStream|createWriteStream)$")) @match
+
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments . (template_string) @path)
+      (#eq? @obj "fs")
+      (#match? @method "^(readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|open|readdir|unlink|mkdir|access|stat|createReadStream|createWriteStream)$")) @match
+
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method
+        (#eq? @obj "res")
+        (#match? @method "^(sendFile|download)$"))
+      arguments: (arguments . [
+        (identifier) @path
+        (member_expression) @path
+      ])) @match
+
+  typescript: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (binary_expression
+          left: (string) @left
+          operator: "+"
+          right: (identifier) @right))
+      (#eq? @obj "fs")
+      (#match? @method "^(readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|open|readdir|unlink|mkdir|access|stat|createReadStream|createWriteStream)$")) @match
+
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments . (template_string) @path)
+      (#eq? @obj "fs")
+      (#match? @method "^(readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|open|readdir|unlink|mkdir|access|stat|createReadStream|createWriteStream)$")) @match
+
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method
+        (#eq? @obj "res")
+        (#match? @method "^(sendFile|download)$"))
+      arguments: (arguments . [
+        (identifier) @path
+        (member_expression) @path
+      ])) @match
+
+  tsx: |
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments
+        (binary_expression
+          left: (string) @left
+          operator: "+"
+          right: (identifier) @right))
+      (#eq? @obj "fs")
+      (#match? @method "^(readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|open|readdir|unlink|mkdir|access|stat|createReadStream|createWriteStream)$")) @match
+
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method)
+      arguments: (arguments . (template_string) @path)
+      (#eq? @obj "fs")
+      (#match? @method "^(readFile|readFileSync|writeFile|writeFileSync|appendFile|appendFileSync|open|readdir|unlink|mkdir|access|stat|createReadStream|createWriteStream)$")) @match
+
+    (call_expression
+      function: (member_expression
+        object: (identifier) @obj
+        property: (property_identifier) @method
+        (#eq? @obj "res")
+        (#match? @method "^(sendFile|download)$"))
+      arguments: (arguments . [
+        (identifier) @path
+        (member_expression) @path
+      ])) @match
+
+  python: |
+    (call
+      function: (identifier) @func
+      arguments: (argument_list
+        (binary_operator
+          left: (string) @left
+          operator: "+"
+          right: (identifier) @right))
+      (#eq? @func "open")) @match
+
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      argument: (simple_expansion) @path
+      (#match? @cmd "^(rm|cat|cp|mv|chmod|chown|mkdir|touch)$")) @match
+
+    (command
+      name: (command_name (word) @cmd)
+      argument: (concatenation (simple_expansion) @path)
+      (#match? @cmd "^(rm|cat|cp|mv|chmod|chown|mkdir|touch)$")) @match
+
+  rust: |
+    (call_expression
+      function: [
+        (field_expression
+          field: (field_identifier) @func
+          (#match? @func "^(open|read|read_to_string|write|create_dir_all|remove_file)$"))
+        (scoped_identifier
+          name: (identifier) @func
+          (#match? @func "^(open|read|read_to_string|write|create_dir_all|remove_file)$"))
+      ]
+      arguments: (arguments . [
+        (macro_invocation
+          macro: (identifier) @macro
+          (#eq? @macro "format"))
+        (binary_expression
+          operator: "+")
+        (field_expression)
+      ])) @match
+
+  java: |
+    (object_creation_expression
+      type: (type_identifier) @t
+      (#match? @t "^(File|FileInputStream)$")
+      arguments: (argument_list
+        (binary_expression
+          operator: "+"))) @match
+
+    (method_invocation
+      object: (identifier) @obj
+      name: (identifier) @method
+      (#eq? @obj "Paths")
+      (#eq? @method "get")
+      arguments: (argument_list
+        (binary_expression
+          operator: "+"))) @match
+
+    (method_invocation
+      object: (identifier) @obj
+      name: (identifier) @method
+      (#eq? @obj "Files")
+      (#match? @method "^(readAllBytes|readString|newInputStream)$")
+      arguments: (argument_list
+        [
+          (identifier) @path
+          (binary_expression) @path
+          (method_invocation) @path
+        ])) @match
+
+  ruby: |
+    (call
+      receiver: (constant) @recv (#match? @recv "^(File|IO|Dir)$")
+      method: (identifier) @method (#match? @method "^(read|readlines|open)$")
+      arguments: (argument_list
+        (string
+          (interpolation)))) @match
+
+    (call
+      method: (identifier) @method (#eq? @method "send_file")
+      arguments: (argument_list
+        [
+          (identifier) @path
+          (call) @path
+        ])) @match
+
+message-captures: [match]

package/rules/external/security/unsafe-innerhtml.test.yaml

@@ -0,0 +1,72 @@
+rule-id: security.unsafe-innerhtml
+
+cases:
+  - name: triggers on innerHTML assignment in javascript
+    language: javascript
+    code: |
+      element.innerHTML = userInput;
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on innerHTML assignment in typescript
+    language: typescript
+    code: |
+      element.innerHTML = userInput;
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on innerHTML assignment in tsx
+    language: tsx
+    code: |
+      element.innerHTML = userInput;
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on dangerouslySetInnerHTML in tsx
+    language: tsx
+    code: |
+      export default function Page() {
+        return <div dangerouslySetInnerHTML={{ __html: userInput }} />;
+      }
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores textContent
+    language: javascript
+    code: |
+      element.textContent = userInput;
+    expect:
+      count: 0
+
+  - name: ignores textContent in typescript
+    language: typescript
+    code: |
+      element.textContent = userInput;
+    expect:
+      count: 0
+
+  - name: triggers on innerHTML in html script tag
+    language: html
+    code: |
+      <script>document.innerHTML = x;</script>
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe script in html
+    language: html
+    code: |
+      <script>console.log("ok");</script>
+    expect:
+      count: 0
+
+  - name: ignores innerHTML read in html
+    language: html
+    code: |
+      <script>if (el.innerHTML) {}</script>
+    expect:
+      count: 0

package/rules/external/security/unsafe-innerhtml.yaml

@@ -0,0 +1,46 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: andy
+# attribution: CWE-79
+id: security.unsafe-innerhtml
+severity: high
+category: security
+min-tier: free
+languages: [javascript, typescript, tsx, html]
+
+copy:
+  name-key: checks.unsafe-innerhtml.name
+  description-key: checks.unsafe-innerhtml.description
+  message-key: checks.unsafe-innerhtml.message
+  degraded-key: checks.unsafe-innerhtml.degraded
+  remediation-key: remediation.security.unsafe-innerhtml
+
+confidence: high
+
+queries:
+  javascript: |
+    (assignment_expression
+      left: (member_expression
+        property: (property_identifier) @prop)
+      (#eq? @prop "innerHTML")) @match
+  typescript: |
+    (assignment_expression
+      left: (member_expression
+        property: (property_identifier) @prop)
+      (#eq? @prop "innerHTML")) @match
+  tsx: |
+    (assignment_expression
+      left: (member_expression
+        property: (property_identifier) @prop)
+      (#eq? @prop "innerHTML")) @match
+
+    (jsx_attribute
+      (property_identifier) @prop
+      (#eq? @prop "dangerouslySetInnerHTML")) @match
+  html: |
+    (script_element
+      (raw_text) @match
+      (#match? @match "\\.innerHTML\\s*="))
+
+message-captures: [match]

package/rules/external/security/untrusted-deserialization.test.yaml

@@ -0,0 +1,79 @@
+rule-id: security.untrusted-deserialization
+
+cases:
+  - name: triggers on pickle.loads in python
+    language: python
+    code: |
+      import pickle
+      data = pickle.loads(input_data)
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe code in python
+    language: python
+    code: |
+      result = str(42)
+    expect:
+      count: 0
+
+  - name: triggers on serde_json from_str in rust
+    language: rust
+    code: |
+      let val = serde_json::from_str(input);
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on bincode deserialize in rust
+    language: rust
+    code: |
+      let val = bincode::deserialize(data);
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe code in rust
+    language: rust
+    code: |
+      let x = 42;
+    expect:
+      count: 0
+
+  - name: ignores custom deserialize in rust
+    language: rust
+    code: |
+      let val = my_codec::deserialize(data);
+    expect:
+      count: 0
+
+  - name: triggers on ObjectInputStream readObject in java
+    language: java
+    code: |
+      Object obj = ois.readObject();
+    expect:
+      count: 1
+      severity: high
+
+  - name: ignores safe java code
+    language: java
+    code: |
+      String s = "hello";
+    expect:
+      count: 0
+
+  - name: triggers on Marshal.load in ruby
+    language: ruby
+    code: |
+      data = Marshal.load(payload)
+    expect:
+      count: 1
+      severity: high
+
+  - name: triggers on YAML.load in ruby
+    language: ruby
+    code: |
+      doc = YAML.load(body)
+    expect:
+      count: 1
+      severity: high

package/rules/external/security/untrusted-deserialization.yaml

@@ -0,0 +1,48 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-502
+id: security.untrusted-deserialization
+severity: high
+category: security
+min-tier: pro
+languages: [python, rust, java, ruby]
+
+copy:
+  name-key: checks.untrusted-deserialization.name
+  description-key: checks.untrusted-deserialization.description
+  message-key: checks.untrusted-deserialization.message
+  degraded-key: checks.untrusted-deserialization.degraded
+  remediation-key: remediation.security.untrusted-deserialization
+
+confidence: high
+
+queries:
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      (#eq? @obj "pickle")
+      (#eq? @method "loads")) @match
+  rust: |
+    (call_expression
+      function: (scoped_identifier
+        path: (identifier) @path
+        name: (identifier) @func)
+      (#match? @path "^(serde_json|bincode)$")
+      (#match? @func "^(from_str|deserialize)$")) @match
+
+  java: |
+    (method_invocation
+      name: (identifier) @method
+      (#eq? @method "readObject")
+      arguments: (argument_list)) @match
+
+  ruby: |
+    (call
+      receiver: (constant) @recv (#match? @recv "^(Marshal|YAML)$")
+      method: (identifier) @method (#eq? @method "load")) @match
+
+message-captures: [match]

package/rules/external/security/weak-encryption-mode.test.yaml

@@ -0,0 +1,126 @@
+rule-id: security.weak-encryption-mode
+
+cases:
+  - name: triggers on createCipheriv with weak mode in javascript
+    language: javascript
+    code: |
+      createCipheriv('aes-256-ecb', key, iv)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on createCipheriv with weak mode in typescript
+    language: typescript
+    code: |
+      createCipheriv('des', key, iv)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on createCipheriv with weak mode in tsx
+    language: tsx
+    code: |
+      createCipheriv('rc4', key, iv)
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores strong encryption mode
+    language: javascript
+    code: |
+      createCipheriv('aes-256-gcm', key, iv)
+    expect:
+      count: 0
+
+  - name: ignores strong encryption mode in typescript
+    language: typescript
+    code: |
+      createCipheriv('aes-256-gcm', key, iv)
+    expect:
+      count: 0
+
+  - name: ignores hash function
+    language: javascript
+    code: |
+      createHash('sha256')
+    expect:
+      count: 0
+
+  - name: ignores hash function in typescript
+    language: typescript
+    code: |
+      createHash('sha256')
+    expect:
+      count: 0
+
+  - name: triggers on AES.new with weak mode in python
+    language: python
+    code: |
+      from Crypto.Cipher import AES
+      cipher = AES.new(key, AES.MODE_ECB)
+    expect:
+      count: 1
+      severity: medium
+  - name: triggers on weak openssl enc mode in bash
+    language: bash
+    code: |
+      openssl enc -des -in plain.txt -out secret.bin
+    expect:
+      count: 1
+      severity: medium
+  - name: ignores AES.new with strong mode in python
+    language: python
+    code: |
+      from Crypto.Cipher import AES
+      cipher = AES.new(key, AES.MODE_GCM)
+    expect:
+      count: 0
+  - name: ignores strong openssl enc mode in bash
+    language: bash
+    code: |
+      openssl enc -aes-256-gcm -in plain.txt -out secret.bin
+    expect:
+      count: 0
+
+  - name: triggers on des in rust
+    language: rust
+    code: |
+      cipher.des()
+    expect:
+      count: 1
+      severity: medium
+
+  - name: ignores strong mode in rust
+    language: rust
+    code: |
+      cipher.aes_256_gcm()
+    expect:
+      count: 0
+
+  - name: triggers on Cipher DES in java
+    language: java
+    code: |
+      class T {
+        void f() throws Exception {
+          javax.crypto.Cipher.getInstance("DES/ECB/PKCS5Padding");
+        }
+      }
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on OpenSSL Cipher DES in ruby
+    language: ruby
+    code: |
+      OpenSSL::Cipher.new('DES')
+    expect:
+      count: 1
+      severity: medium
+
+  - name: triggers on OpenSSL Cipher DES ECB in ruby
+    language: ruby
+    code: |
+      OpenSSL::Cipher.new('DES-ECB')
+    expect:
+      count: 1
+      severity: medium

package/rules/external/security/weak-encryption-mode.yaml

@@ -0,0 +1,104 @@
+# source: clean-room
+# licence: MIT
+# vendored-at: 2026-05-20
+# verified-by: Seaworthy team
+# attribution: CWE-326
+id: security.weak-encryption-mode
+severity: medium
+category: security
+min-tier: pro
+languages: [javascript, typescript, tsx, python, bash, rust, java, ruby]
+
+copy:
+  name-key: checks.weak-encryption-mode.name
+  description-key: checks.weak-encryption-mode.description
+  message-key: checks.weak-encryption-mode.message
+  degraded-key: checks.weak-encryption-mode.degraded
+  remediation-key: remediation.security.weak-encryption-mode
+
+confidence: high
+
+queries:
+  javascript: |
+    (call_expression
+      function: (identifier) @func
+      arguments: (arguments
+        (string
+          (string_fragment) @algo))
+      (#eq? @func "createCipheriv")
+      (#match? @algo "ecb|des|rc4|3des")) @match
+  typescript: |
+    (call_expression
+      function: (identifier) @func
+      arguments: (arguments
+        (string
+          (string_fragment) @algo))
+      (#eq? @func "createCipheriv")
+      (#match? @algo "ecb|des|rc4|3des")) @match
+  tsx: |
+    (call_expression
+      function: (identifier) @func
+      arguments: (arguments
+        (string
+          (string_fragment) @algo))
+      (#eq? @func "createCipheriv")
+      (#match? @algo "ecb|des|rc4|3des")) @match
+  python: |
+    (call
+      function: (attribute
+        object: (identifier) @obj
+        attribute: (identifier) @method)
+      arguments: (argument_list
+        (attribute
+          object: (identifier) @aes
+          attribute: (identifier) @mode))
+      (#eq? @obj "AES")
+      (#eq? @method "new")
+      (#match? @mode "MODE_(ECB|CBC|CFB|OFB)$")) @match
+  bash: |
+    (command
+      name: (command_name (word) @cmd)
+      argument: (word) @subcmd
+      argument: (word) @mode
+      (#eq? @cmd "openssl")
+      (#eq? @subcmd "enc")
+      (#match? @mode "^-(des|des3|rc4|bf|aes-[0-9]+-ecb)$")) @match
+  rust: |
+    (call_expression
+      function: (field_expression
+        field: (field_identifier) @func
+        (#match? @func "^(des|rc4)$"))) @match
+  java: |
+    (method_invocation
+      object: (identifier) @obj
+      name: (identifier) @method
+      (#eq? @obj "Cipher")
+      (#eq? @method "getInstance")
+      arguments: (argument_list
+        (string_literal
+          (string_fragment) @algo)
+        (#match? @algo ".*(DES|des|RC4|rc4|ECB|ecb).*"))) @match
+
+    (method_invocation
+      object: (field_access
+        field: (identifier) @obj)
+      name: (identifier) @method
+      (#eq? @obj "Cipher")
+      (#eq? @method "getInstance")
+      arguments: (argument_list
+        (string_literal
+          (string_fragment) @algo)
+        (#match? @algo ".*(DES|des|RC4|rc4|ECB|ecb).*"))) @match
+
+  ruby: |
+    (call
+      receiver: (scope_resolution
+        scope: (constant) @scope (#eq? @scope "OpenSSL")
+        name: (constant) @name (#eq? @name "Cipher"))
+      method: (identifier) @method (#eq? @method "new")
+      arguments: (argument_list
+        (string
+          (string_content) @algo
+          (#match? @algo ".*(DES|des|RC4|rc4|ECB|ecb).*")))) @match
+
+message-captures: [match]